Mozilla releases updates for flaws that could result in system hijacking in its open-source browser, e-mail client and Internet applications suite.
The Mozilla Foundation
has released security updates to fix multiple flaws that could result in system hijacking in its open-source Firefox browser, Thunderbird e-mail client and SeaMonkey Internet applications suite.
The bugs, deemed critical, are detailed in Mozillas Security Advisory 2007-12
. They include multiple vulnerabilities in Mozillas Layout Engine
engine that can result in memory corruption and lead to system takeover or DoS (denial of service). The function of a layout engine is to handle content such as HTML, XML, image files and applets as well as formatting information including CSS (Cascading Style Sheets) and presentational HTML tags. The layout engine displays the formatted content on-screen, filling in the browsers content area.
Firefox users who dont install the ANI patch are in danger of files being overwritten in an attack, given that the browser lacks a low-privilege mode.Click here to read more.
According to Mozillas advisory, the impacts of the vulnerabilities vary. "Some of these crashes that showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code," the advisory says.
Mozilla fixed the Layout Engine bugs in these updates: Firefox Versions 22.214.171.124 and 126.96.36.199; Thunderbird Versions 188.8.131.52 and 184.108.40.206; and SeaMonkey Versions 1.0.9 and 1.1.2. The downloads are available at the advisory site
Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEKs Security Watch blog.